Internal Auditors & Self-Destruction!

Do some internal auditors come equipped with self-destruction mechanism? Sadly, the answer to this question is yes! Recently, a member of my LinkedIn group “Internal Audit & Risk Management Consultants” Posted a discussion enquiring whether internal audit can answer an internal control questionnaire on areas other than internal audit such as HR and accounting.The discussion was very popular with many internal auditors offering their cliché answer:

“Internal Controls are the responsibility of management; Internal Audit should not complete the questionnaire.”

And of course, the justification for this answer was that completing the questionnaire impairs internal audit independence!Once again, some internal auditors try to hide behind independence and elect to do nothing and prove over and over again that internal audit can be stagnant and irrelevant!I was so frustrated with most of the comments to the point of saying in one of my updates:

“Comments posted on a discussion on my LinkedIn group confirmed that the worst enemy of internal audit is internal auditors themselves!

Assuming that answering the questionnaire impairs independence, internal auditors should not push the self-destruct button and stop at providing their cliché answer.They should recognize that their insight and experience are needed, and they should be creative in finding an alternative way to participate and add value!

Wishing you all a successful and happy new year!

The Internal Auditor is Now Available on Amazon!

The Internal Auditor (short fiction) is now Available on Amazon for Pre-Order! Below is a link to order:


                           Amazon Canada


You can also order it from other Amazon Country websites depending on your Country.

My Thoughts is now on Amazon!

I have combined my internal audit posts from 2011 to 2016 in one document. It is now available at Amazon for only US $3.If you find my posts interesting, this document will be a useful tool to access the posts. It can be bought using the below link (Amazon Canada) or the Amazon webpage for your Country:

                                            https://www.amazon.ca/dp/B01N591VRA

The Internal Auditor

Would the new #CAE survive office politics and ploys? Stay tuned to my first #internalaudit short fiction coming soon (will be available on Amazon during January 2017)

A taste of what is coming ( I will be looking for a professional editor soon):

"It was supposed to be another routine day at the office for Steve Anderson , the newly appointed Chief Audit Executive (CAE) at the Advanced Technology Corporation. But in reality, there is no such thing as a routine day in the life of an internal auditor! When Steve arrived at his office at 8:00 am on Monday he had received a call from the assistant of Mike Smith, the Chief Financial Officer (CFO), asking him to come and meet with her boss urgently.
Steve joined the company about a month ago after working for a medium - sized accounting firm in the city for about five years. Ever since he had joined the company, he tried to establish communication channels with management members to help him introduce his vision of internal audit and to obtain a better understanding of the business and management expectations. One of the hardest people to connect with was Mike Smith who usually gives Steve the cold shoulder and does not show interest in the internal audit activity. So today’s call from Mike not only came as a surprise, but also with a lot of skepticism!"

http://www.bibiconsulting.net/The-Internal-Auditor.html

Let's not Glorify the Fraud Culture!

 Recently, I have been watching some interesting TV shows!The common theme of these shows evolved around fraudsters and con men who are portrayed as being smart and charismatic with exceptional talent. Some are portrayed as the go to experts to solve problems that can't be solved by hard working honest professionals!They are presented to be the solution rather than the problem. The sad reality is that it is easy for most of us to admire such characters and fall in love with them!

The Dangerous Message!

While the purpose of the shows is to provide entertainment, they are also sending an unintentional dangerous message to the youth that being a fraudster is actually a "cool thing". It is not a secret that at this era of rapid technological advancement the difference between what is real  and is virtual  and fiction may not be so obvious to some!

It All Starts at Home!

Fraud will always be out there and it will be evolving contentiously .We can not completely eliminate it, but we can fight it before it becomes a monster ( if it does not already became one in your country). We can only do this by starting  at the source, our kids!

 Preventing, fighting  and building awareness about fraud starts at home at an early age. Parents need to keep a close eye on what their children read and watch and who their role model is.
 A few years back, my teenage son expressed his desire  to become a broker after watching the Wolf of Wall Street movie! It took several rounds of discussions to explain to him the difference between an ethical broker and a bad one.

Let's not glorify the fraud culture and start to build an anti-fraud one starting from our homes!

These are my thoughts, please share yours

Is There Such Thing as the "Future Auditor"?

The last issue of Protiviti's "The Bulletin" entitled "The Future Auditor Revisited ", discusses some of the characteristics of future auditors and how they can add more value and stay relevant. It builds on  the firm's 2014 vision of future auditors. It suggests that future internal auditors should:

• Focus More on Strategic Risks
• Think Beyond the Scope
• Add More Value Through Consulting
• Facilitate Effective, High Quality Communication 
• Elevate Stature and Perspective
• Align Stakeholder Expectation

The firm offered an example of 15 ways the future auditors can achieve the above and add value:

While I have no problem with the above, I am not sure why we are still talking about it as the "future" when it has been around for years! Should not this be the present and we start thinking beyond it to shape the future of internal audit. Are internal auditors stuck in their past that the future remains a moving target! Or to put it bluntly:Is there such thing as the future auditor?

These are my thoughts,please share yours!

  

Internal Audit is not Rocket Science,but it Still Needs to be Managed by Qualified Professionals!

A member of my LinkedIn group (Internal Audit & Risk Management Consultants) has posted a serious of discussions asking for help in understanding several  audit concepts and  techniques for the purpose of starting what sounds to be a new internal audit activity.The member does not seem to have previous internal audit experience (at least this is my impression from the questions raised).I am happy that many members have offered advice and guidance based on their experience and that the group, once again, has been utilized to add value to its members.But at the same time,I am troubled with the idea of tasking someone with no internal audit experience or qualification to start building an internal audit activity!Unfortunately,I come across similar situations too often! I am in no way trying to undermine the experience or qualification of this member, to the contrary I appreciate it when one asks for help when he/she needs it! I am simply trying to shed  light on this important issue!

Would you ask a civil engineer  to perform an open heart surgery? Of course not, regardless of how  good  this engineer is at what he/she does (engineering)! Why do companies ask people with no internal audit backgrounds to start an internal audit activity? It could be one or more of the following reasons:

• Lack of understanding of what internal audit is about and what qualifications are needed to do the job.
• Lack of appreciation of the importance of internal audit on the basis that it is not a rocket science, anybody can do it!
• The desire to save money by not hiring qualified auditors and trying to utilize existing resources regardless of their experiences.
• The person tasked with starting the internal audit activity is very much trusted by management and their is a  belief that he/she can handle the assignment regardless of experience!
• Sometimes someone with no prior internal audit experience will volunteer to set up shop and convinces  management that he/she can handle it!

I do not believe it is fair to any person to be put in such a situation regardless of the circumstances. The consequences to the company and other stakeholders as a result of this practice may be serious! It could simply be that the internal audit activity is doomed to fail before it set sail!

My advice to any person in similar situation is to have an honest and open discussion with management and explain what he/she can or can not do.Asking colleagues/contacts for help is fine,but sometimes outside professional help through hiring or other venues will be needed and should be done with management's  knowledge and approval!

Let's remember what standard 1210 stipulates:

"Proficiency: Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity collectively must possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities."

Can you imagine the consequences of  this situation especially when the entire internal audit activity consists of that single person with no internal audit experience!

These are my thoughts, please share yours!

The Cost of Bad Internal Audit Activities!

The cost of not having an internal audit activity is relatively well recognized and understood by most corporations and investors. However, the cost of having a bad one may not be so obvious and understood by some!

But, what is the definition of bad as it relates to this post? I am sure the first thing that jumps to your mind is the “value adding” theme! Others may add “inefficient”, “ineffective”, “irrelevant”, "weak”, “stagnant” and “stress creating” to the list! The list can go on and on depending on who is providing the input!

Regardless of the definition, the cost of having a “bad” internal audit activity may include:

- Damage to the reputation of the Internal Audit profession as a whole!

- Damage to the credibility of management and the Audit Committee at the concerned organization.

- Loss of the public and investors’ trust in the organization.

- Management not getting relevant and timely information to help make  the right decisions. Or worse, getting wrong information resulting in major problems! 

- Management and other stakeholders getting false sense of security.

- Major risks go unidentified, undetected or underestimated.

- Waste of time, resources and money!

- Loss of opportunity for real improvement of operations.

- Distraction and loss of focus on real issues.

- Disruption of business and processes.

- Negative impact on other assurance and compliance functions.

Sadly,the above is not a comprehensive list! Can you suggest more items to it?

 You may have noticed that some of the costs listed above are also applicable to situations where internal audit activities do not exist at all! Based on that and If you have to choose between having a bad internal audit activity (on the basis that something is better than nothing!) or not having one at all, which would be your choice?

The first step in “fixing” a bad internal audit activity is by admitting that there is a problem, then having the courage to seek help!

These are my thoughts,please share yours!

التدقيق الداخلي بين تقييم الأداء و الجمهور عايز كده

يؤمن البعض بان المقياس الحقيقي لإداء ادارة التدقيق الداخلي و ما تضيفه من قيمة على المؤسسة هو في مدى رضا أصحاب الشأن أو المصلحة (Stakeholders ) عن هذا الأداء على قاعدة أن القيمة هي في عين الناظر (value is in the eye of the beholder).والناظر هنا بالطبع هم أصحاب المصلحة!

أوافق على هذه المقولة، بل و اشجع عليها إن تحققت الأمور التالية:

• وجود إدارة و لجنة تدقيق على ادراك كامل بما يتوجب على التدقيق الداخلي إنجازه بحسب معايير التدقيق الداخلي وافضل الممارسات المهنية ( best practices) حتى تتمكن من تقديم تقييم موضوعي و عادل.
• ومن البديهي القول بضرورة وجود أهداف محددة و واضحة و عقلانية تسعى الإدارة إلى تحقيقها.
• وجود النية الحقيقية عند أصحاب المصلحة في وجود إدارة تدقيق داخلي قوية و مؤثرة ،وليس مجرد وجود شكلي يتم المبالغة في الثناء عليه لغرض في نفس يعقوب! 
• القيام بواجبات التدقيق الداخلي بكل حيادية وموضوعية وجراءة بهدف إضافة قيمة حقيقية، لا لمجرد  التقرب من أو إرضاء رغبات أصحاب المصلحة باي شكل من الأشكال. إن ارضاء الادارة العليا و لجنة الإدارة يجب أن لا يكون هدفا بحد ذاته بل نتيجة طبيعية يتم التوصل إليها  عندما يقوم التدقيق الداخلي باداء مهامه بحرفية و مسؤولية و أمانة.   

إن لم تتوفر الأمور السابقة الذكر فان تقييم الأداء لن يزيد عن كونه عملية عقيمة على طريقة "الجمهور عايز كده" !!

وخير الكلام ما قل و دل!

هل هو "تدقيق داخلي" ام "مراجعة داخلية"؟ دعونا نتفق على المصطلحات

في الأيام القليلة الماضية كان لي تغريدات تتعلق بالترجمة العربية لبعض المصطلحات المهنية واهمها الترجمة للمصطلح :

 

"Internal Audit"

وعلى الرغم أن الأمر يبدو في ظاهره على انه خلاف شكلي إلا انه يستحق منا أن نبذل الجهد المهني الكافي لتوحيد ترجمة المصطلحات المهنية حرصا على تطوير الخطاب العربي المهني ولإزالة الالتباس والخلط الذي يصاحب استعمال اكتر من ترجمة ,فهناك  على سبيل المثال فرق كبير بين التدقيق و المراجعة  (في مجال التدقيق الخارجي على الاقل)  من حيث الهدف ونطاق العمل.

ومن الجدير بالذكر بان معهد المدققين الداخليين (IIA)  يعتمد "التدقيق الداخلي" في منشوراته باللغة العربية.

ومع التطور المستمر لمهنة التدقيق الداخلي في الوطن العربي فإنني أوجه النداء إلى معاهد و جمعيات التدقيق الداخلي و المراجعة الداخلية إلى تشكيل لجنة تنسيق موحدة لتحقيق هذا الهدف  للرقي بهذه المهنة إلى اعلى المستويات.

أتمنى أن يحصل هذا و أن نكون متحدين على المستوى المهني على الأقل!  

    

The State of Internal Audit in the GCC Region!

The Saudi Institute of Internal Auditors and the UAE Internal Audit Association have recently issued a research report discussing the state of internal audit in the Gulf Cooperation Council (GCC) Region.

The report was based on a survey that included 918 internal auditors across the region (Saudi Arabia, UAE, Kuwait, Qatar, Bahrain and Oman).

The key findings of the report are as follows:

• Positioning of the Internal Audit Activity

The survey results show that the majority (77%) of the IA activities in the region functionally  report to the Audit Committee or board. When it comes to administrative reporting 64% of the activities surveyed report to the CEO or equivalent position.                 

• Role of the Internal Audit Activity

Only one third of the surveyed respondents indicated that the three lines of defense model is defined and understood in their organizations.

The assurance services are the dominant value adding services with consulting services on the rise. 

• Internal Audit Focus Areas

only 50% of the respondents indicated that their IA activities are aligned with the strategic plans of their organizations. Operational risks seem to be the focus of most of the activities in the region.

• Processes and Operations

Formal internal audit strategic plans are not present in many of the surveyed activities. Only small number of activities adopt a flexible audit plans although the majority update their audit plans at least annually.

only 57% of IA activities follow all of the IIA standards with the quality assurance standard being the least complied with.

•  Skills and Resources Management

Accounting skills remain the most sought after skills when recruiting internal auditors.

54% of internal auditors and 40% of CAEs  in the region do not posses any internal audit certification.

• Leading Practices and trends

Internal audit activities in the region seem to be behind when it comes to combined assurance, performance audit and auditing ethics and cultures.

• Managing Expectations & Demonstrating Performance

Most of the IA activities do not use formal KPIs. Traditional performance  measurement techniques such as number/percentage of audits completed are in use.

While the results of the survey did not include any significant surprises, it is obvious that despite of the advancement of the profession in the GCC region, there are still many opportunities for improvement .

The report provided an excellent source of information for management, audit committees ,CAEs and independent internal audit consultants ,like myself, to focus their efforts on the right direction!

I would certainly love to see similar reports for the rest of the Middle East countries!

We get it, you are proud to be an Internal Auditor! But, what are you doing to promote the profession?

Each May, many Internal Auditors show their pride in their profession by posting the IIA's digital icon "Proud to be an internal auditor" all over the Internet. That is great! They have every right to be proud, but is this enough? What are they actually doing to promote the profession and raise awareness about it?

         "It is not enough to talk the talk, Internal Auditors need to walk the walk as well!"

The IIA publishes annual "awareness toolkits", which include tips and templates, to help guide internal auditors to celebrate the awareness month and spread the word about the value and role of internal audit. While the toolkits include useful practical suggestions, I have not seen statistics or evidence showing how and to what extent they are utilized!

This post is not intended to discuss how to promote the profession, as I believe this is a mental exercise that internal auditors need to arrive at by themselves! Just keep in mind that every internal auditor is an ambassador of the profession and his/her actions (or lack of) are what promote or hinder the profession.

There are no "one size fits all" tools that internal auditors can use around the world. Each internal audit activity needs to customize its own awareness campaign to fit the culture and business practices of its organization and country. For example, while producing "bumper stickers" could be a great idea in North America, it may not be a useful tool in other parts of the world! The local IIA chapters should spearhead the efforts to create local tools!

And because actions speak louder than words, the best promotional tool remains the value internal auditors add throughout the year!

         "Let your stakeholders be your greatest promotional tool, Let them celebrate you!"

Have a happy awareness month!

How Do Internal Auditors Gain Influence?

I have recently attended an IIA webinar "The Evolution of Internal Audit: Assure, Advise, & Anticipate" presented by Deloitte. The first part of the presentation had an interesting theme "Adapt or Disappear"! The message to internal audit was crystal clear: "do not be a dinosaur". The presentation offered the following action plan for internal audit to navigate from present to future:

While there is no surprises in the above four steps, the "gain influence" part caught my attention!

How do Internal Auditors Gain Influence?
In a document that bears the same title (Adapt or Disappear),Deloitte explains how influence is gained as follows:

"Strong leadership from the CAE, a compelling articulation and cultivation of an impactful role, including as a trusted advisor, will help raise the stature of internal audit and gain the CAE a seat at the table with other c-suite executives for greater influence and impact".

I would simplify this by providing my suggested  formula:

Courage + Vision + Charisma + Passion + Effective Communications + Relevant Audits + Practical Advice + Marketing Plan + Real Time learning!

I may also add "Translation" which is a term I borrowed from a Harvard Business Review article. It was explained as: "personally helping decision makers understand complex content".

Now, what is your strategy to gain influence? Please share your thoughts and experience.

The Big Question:Shall I Move from External to Internal Audit?

One of my LinkedIn connections  sent me the following message:

"Dear Wa'el
 hope everything is well. as I see that you are an internal auditor professional, so I would like to ask for you advise. I'm working for Big4 as an external auditor, and recently I have received an offer from international company for an internal auditor position and I am confused if I want to move on or to stay, so as you are an internal experience auditor what do you say? Thanks in advance"

I have replied as follows:
"Dear ....,
Thank you for contacting me. While I am not a career internal auditor (I provide internal audit consultation), I will attempt to address your question as objectively as I can!
1. I have started my professional life with Arthur Andersen in the Middle East and stayed there until I became a partner! Why? Because I loved and enjoyed what I was doing and secondly, my objective from day one was to make it to the partnership level.
 Now ask yourself these questions:
- When you wake up in the morning do you look forward to going to your office or working with   clients?
- Do you really enjoy what you are doing. Do you do it with passion, or is it only a job to you?
- Are your career objectives clear an do you know what you want to be in 10 years?
2. Internal audit comes with its own challenges and limitations! Unlike external audit, internal auditors gain deeper understanding of the business but at the same time their experience may be limited to their company or to the industry it is in! Many professionals join internal audit to gain experience and move out to operations at a later stage. For the fun of it, almost each new internal auditor I talked to in the past wanted to be the CEO of the company in the near future!
3.How the internal audit activity at the company is valued and treated should be a major factor in your decision to move there. Company culture and tone at the top is an essential indicator, so do your homework!
4.If there is no strong and courageous CAE (with a vision & mission) leading the internal audit activity, then the future does not look promising!
 At the end of the day, you are the only one who can take that decision. Take it without pressure and just follow your gut!
Good luck, and please keep me informed of your decision! "


What else would you add to my answer? Have you made the move from external to internal audit? If so, what was your experience?

These are my thoughts,please share yours!

Interesting Takeaways from the IIA - PwC Cybersecurity Session!

It is not a secret that I am not a big fan of the IIA Ottawa Chapter!



I usually avoid its IIAOttawa@Noon training events ,but today I have attended  the event because the topic is of high interest to me.The session was about "Trends in Cybersecurity and Privacy" and was based on PwC 's Global State of Information Security Survey 2016.The presentation was delivered by two PwC partners from the Toronto and Ottawa offices. The full survey is available at the PwC website, so I am not going to repeat any of its contents here, but rather would like to share some of the interesting points discussed during the session:

• Organized crime "as- a -service" is on the rise on the deep web! It is much easier to hire criminals online than ever before!
• Insiders and former insiders remain the biggest risk to cybersecurity and the focus of the cybersecurity experts.
Cybersecurity insurance is gaining momentum in the private sector ,the public sector is still to catch up!

• Cybersecurity and Privacy are business issues, internal auditors should avoid the technology trap when dealing with it.
• More organizations are monitoring the activities of their employees during and after working hours!
• Canada is slow in using the cloud due to fear of the "big brother" eyes!
• Canada is behind when it comes to cloud usage guidance. It did not issue official guidance similar to those issued by the US and the UK.
• Ontario.ca website ,that we Ontarians use to renew our driving licences and health cards,  is hosted by Amazon! The justification is that it provides the highest security  available in light of the daily 2-3  denial-of-service (DoS) attacks it receives.
• And finally compliance with cybersecurity frameworks does not necessary mean security is achieved! 

I must admit that I have enjoyed today's event and found it informative and relevant! I am glad I have attended .
The $20 I paid for parking fees was indeed a good investment!

Can Positive Illusions be the Survival Solution for the Unappreciated Internal Audit Activity?

Let’s imagine this hypothetical scenario:

“you are managing an internal audit activity and working really hard to make it a value-adding function to the organization. But yet, whatever you do go unnoticed and/or unappreciated by management and the Board”

What do you do in this situation?

Call it a quit and leave?
 Or
Hang on and keep trying to win the hearts and minds of management and hoping that one day your hard work will pay off?
 If you choose the second option, how would you be able to mentally and psychologically survive until you achieve your goal?
The answer, according to some psychologists, may be in adopting “positive illusions”!

What are Positive Illusions?

According to Wikipedia:
Positive illusions are a form of self-deception or self-enhancement that feel good, maintain self-esteem or stave off discomfort at least in the short term. There are three broad kinds:
- inflated assessment of one's own abilities,
- unrealistic optimism about the future,
- and an illusion of control.

If you were in the shoes of the internal audit leader in the above mentioned hypothetical situation, which option would you choose? Is there third or more options? Would you adopt positive illusions as a mechanism to survive or would you come with other techniques?

Please share your thoughts!

التدقيق الداخلي والمخاطر الجيوسياسية

 ان المتغيرات السياسية و الاقتصادية المتسارعة في المنطقة و ما ينتج عنها من عدم استقرار و عدم يقين

  تتطلب 

التعامل مع المخاطر الجيوسياسية بجدية اكثر من اي وقت مضى 

في مقالة نشرها معهد المدققين الداخليين في بريطانيا عام 2015,تمت الإشارة الى ان دراسة حديثة بينت بان 70 بالمائة من المدراء التنفيذين المشمولين بالدراسة ينظرون الى التوترات السياسية في العالم على انها تشكل خطرا على النمو الاقتصادي خلال فترة ال 12 شهرا التالية للدراسة وذلك بزيادة مقدارها 27 بالمائة منذ نهاية عام 2013.

ان نظرة واحدة على قائمة اهم مخاطر 2016 التي تصدرها مجموعة يوراسيا المتخصصة بتحليل المخاطر السياسية العالمية كفيلة بطرد النوم من اعين المدققين الداخليين ولجان التدقيق في الشرق الأوسط! كما ان نظرة أخرى على قائمة المخاطر لنفس العام الواردة ادناه والصادرة عن المنتدى الاقتصادي العالمي تبين أهم الاخطار الجيوسياسية على العالم:

بالمقابل فان تقرير معهد المدققين الداخليين الصادر في أذار من عام 2015 تحت مسمى "نبض التدقيق الداخلي" يشير الى ان 6 بالمائة فقط من الذين شملتهم الدراسة اعتبروا ان التطورات الجيوسياسية بما فيها المقاطعة الاقتصادية لها تأثير هام على خطة التدقيق بينما قال 40 بالمئة بأنهم لا يعيرون هذه التطورات اية أهمية! في الحقيقة فان هذه النتيجة مقلقة وقد اعتبرها التقرير ناتجة عن عدم قدرة التدقيق الداخلي على "توصيل النقاط". وانا اضيف الى ذلك عدم قدرة التدقيق الداخلي على استيعاب وفهم “الصورة الكبرى" وعدم فهم مكونات الاخطار الاستراتيجية!  

 ربما لم تكن المخاطر الجيوسياسية أولوية على اجندة وظائف التدقيق الداخلي في الشرق الاوسط في السنوات الماضية على الرغم من تاريخ المنطقة الحافل بالأزمات، وذلك يعود الى ان التدقيق الداخلي في تلك المرحلة كان يمر بعملية ولادة واثبات وجود بالإضافة الى جهوده المستمرة في تطوير نفسه. ولما كان التدقيق الداخلي قد قطع شوطا طويلا في تحقيق هذه الأهداف فهو مهيئ الان لان يقوم بدوره في فهم ومواجهة هذه المخاطر!

قبل القيام بأي دور على التدقيق الداخلي:

1.  ان يكون لديه الاطلاع الكافي على اهم التطورات السياسية والاقتصادية في بلده وفي دول الجوار وان يقوم بمتابعتها عن كثب ومن أكثر من مصدر واحد. على ان تكون هذه المصادر حيادية وذات مصداقية عالية وبعيدة عن الاجندات السياسية والاقتصادية الضيقة والخاصة.

2. ان يكون لديه الفهم العميق لتأثير المخاطر الجيوسياسية على المنشأة بشكل عام، وعلى مستوى العمليات الفردية. 

3. ان يلتزم الحياد التام والموضوعية والاستقلالية في جمع وتحليل المعلومات وتقدير المخاطر بعيدا عن المعتقدات السياسية الخاصة به. ان المدقق الداخلي ليس محللا سياسيا او اقتصاديا ولاحد يتوقع منه القيام بهذا الدور!

دور التدقيق الداخلي

دور المدقق الداخلي بالنسبة للمخاطر الجيوسياسية لا يختلف عن دوره في المخاطر الأخرى والتي يحكمها المعيار 2120,     والتي لا داعي لتكرارها هنا، الا من حيث ان طبيعة الاخطار الجيوسياسية تتطلب لباقة أكثر في عرضها ومناقشتها ومراقبة أعمق لها في الدول المصنفة بانها عالية المخاطر نظرا لان أثارها قد تكون كارثية على المنشأة. بشكل عام فان على التدقيق الداخلي ان يقوم بما يلي:

1.القيام بتقييم شامل ومستقل للمخاطر الجيوسياسية بالتعاون والتشاور مع الإدارة، لجنة التدقيق وإدارة المخاطر بهدف تحديد المخاطر الأكثر أهمية ودمجها في خطة التدقيق. والقيام بتعديل الخطة بناء على نتائج التقييم المستمر والمخاطر المستجدة. وهذا يتطلب ان يكون للتدقيق الداخلي القدرة على القيام بالتنبؤ بالمخاطر التي قد تستجد مستقبلا. 

2.التاكد من ان الادارة ولجنة التدقيق على دراية تامة بهذه المخاطر واثارها وأنها تقوم باتخاذ الإجراءات المناسبة للتعامل معها ومعالجتها في الوقت المناسب.

3.التاكد بان لجنة المخاطر تقوم بعملها بكل كفاءة وفعلية وأنها تقوم بتقديم المعلومات المناسبة والضرورية للإدارة بالوقت المناسب.  

4.التاكد من وجود خطط ملائمة "لاستمرارية العمل" و "التعافي من الكوارث" ومدى مطابقتها لاحتياجات المنشأة. كما يجب التأكد من ان هذه الخطط يتم تحديثها وتجربتها بشكل دوري.

5.التاكد من كفاية التامين لتغطية الاثار الناجمة عن مخاطر الحروب، الاعمال العدائية، الكوارث البيئية والطبيعية، هجرة المدنيين وانقطاع الدخل.

6.التاكد من قيام إدارة الموارد البشرية بأجراء "فحص الخلفية" لكافة الموظفين قبل التوظيف والحصول على الموافقات الأمنية اللازمة ومراقبة اية تصرفات تثير الشكوك والابلاغ عنها مباشرة للإدارة.

7.التاكد من قيام المنشأة بالامتثال للقوانين والتشريعات المتعلقة بغسل الاموال ومكافحة الإرهاب.

الخلاصة بان تقييم المخاطر الجيوسياسية ليس " ترفا فكريا" أو تعاطيا بالسياسة وانما هو جزء أساسي 

من مهمه المدقق الداخلي الناجح الذي يضيف قيمة للمنشـأة التي منحته ثقتها ! ا

Do You Have Enough Stress?

Last night, I was watching a rerun episode of  "The Big Bang Theory" show. In this episode, Sheldon concluded that he needs some "productive anxiety" in his life to boost his performance in order to solve a scientific issue he was having difficulties with. He explained his needs to his friends as follows:
"According to a classic psychological experiment by Yerkes and Dodson, in order to maximize performance, one must create a state of productive anxiety. So I’d like to ask you all to do something for me. Keep me on my toes. Just throw me off my game. Essentially, go out of your way to make my life miserable"

While the objective of the show is to make us laugh, the Yerkes and Dodson Law is real. To explain it in few words, I am borrowing the below paragraph from The ExaminedExistence website:
"The Yerkes-Dodson law states that performance increases with physiological or mental arousal (stress), but only up to a point. When the level of arousal (stress) becomes too high, performance decreases".

I guess internal auditors are lucky! They have access to endless sources of stress, at all levels, from all stakeholders! So, next time management or the audit committee gives you a hard time, convince yourself that this is a blessing in disguise. They are only trying to boost your performance!


The concept of productive anxiety resonates with me. I would like to think that my best performance is achieved when I am under pressure and stressed out! It simply stimulates my brain and forces me to leave my comfort zone!

Do you have enough stress? If not, create some "calculated" stress in your life!

These are my thoughts, please share yours!

Please God, let Him Not be an Internal Auditor!

A visitor to my company’s website (www.bibiconsulting.net) has sent me the following message:  “send to me all publications”

 

He was referring to a section in the website where I offer visitors to send them a PDF copy of my blog posts. My first reaction was “wow”! I do not see “hello”,” please” or “thank you”! My second reaction was a prayer “Please God, let him not be an internal auditor”!

 

Before I proceed with this post, I should show some manners and thank the visitor for inspiring this post!

 

Can you imagine what would be the reaction of a customer if an internal auditor communicates with him/her in this way! This type of manners will not only reflect on the auditor alone, but on the internal audit activity as a whole, on its reputation and on its efforts to market itself as a professional value adding party!

 

Good manners, in general, and good communications manners, in particular, are part of the “must have” soft skills for internal auditors! I call on CAEs to take a hard look at their auditors’ communication manners and offer guidance and training when needed.

 

Bottom line is “Manners still matter”!

These are my thoughts, please share yours!